Answers for "How to create a dashboard when required fields are not present in the event logs?"https://answers.splunk.com/answers/223181/how-to-create-a-dashboard-when-required-fields-are.html
The latest answers for the question "How to create a dashboard when required fields are not present in the event logs?"Answer by chimellhttps://answers.splunk.com/answering/223345/view.html
Hi
If the file contain these fields
try like this
source="/opt/www/logs" | table jobTitle orgName orgSegment parentOrgname userTypeFri, 20 Mar 2015 12:27:45 GMTchimellAnswer by gyslainlatsahttps://answers.splunk.com/answering/222063/view.html
hi moiezuddin,
it is necessary to extract these fields using regular expressions before achieving dashboards using these fields. And for that you need to identify in your data the values corresponding to each field you need.
eg extraction of the field at random from your data:
`source="dashboard_field.csv" host="student09-PC" index="field" sourcetype="csv" |rex "^[^'\n]*'(?P\w+'\))" |table type`
this allows to retrieve the values of a certain type field that I choose.
try this and let me know if it works. or or you send me the file with which you work at `gyslainko@gmail.com`, and I'll help you extract these fields and then send you the regular expressions that you will use to work with.
please forgive my english. afterThu, 19 Mar 2015 10:07:26 GMTgyslainlatsa